Dear Open Source Developers: It's OK not to embargo

Open source developers now have the option to handle low and medium severity vulnerabilities differently. Instead of waiting for a private embargo period before making them public, they can simply report these issues in the public issue tracker. This change comes from Curl, a popular open source project, and is aimed at reducing the overwhelming number of vulnerability reports they receive.

The traditional approach involves privately reporting a vulnerability to the project or vendor, allowing them time to fix the issue before it becomes public knowledge. However, with the sheer volume of vulnerabilities being reported daily, this method is becoming more and more impractical. Many developers are volunteers who are already stretched thin and may not have the resources or time to handle embargoes properly.

Furthermore, not all vulnerability reports are security-related; some are just regular bugs. This new policy encourages developers to treat such lower-severity issues as regular bugs, rather than treating them as special cases that require additional scrutiny. By adopting this change, open source projects can alleviate some of the pressure they face when dealing with the massive influx of vulnerability reports.